Revolut disclosed that it handed over sensitive customer data to a malicious actor after receiving a fraudulent request disguised as a legitimate government inquiry. The request was sent from an unauthorized email account using an official government agency domain, which carried valid domain authentication credentials that led Revolut to fulfill it as genuine.
According to a customer notification, the exposed data included identity details such as full name, date of birth, and occupation; contact information including postal address, email, and phone number; and document verification data including passport or driver's license copies and verification selfies.
For cryptocurrency users, the financial data exposed proved particularly concerning. The breach included account statements with IBAN and wallet reference numbers, withdrawal records, and full transaction histories including Bitcoin transactions.
A Revolut spokesperson confirmed the incident to TechCrunch, describing it as "a sophisticated external impersonation scam where an unauthorised third party utilised a legitimate government agency domain email to submit fraudulent requests for information." The company stated that a "limited" number of customers were affected and that its systems and customer funds remained unaffected. Revolut declined to specify the number of affected customers or identify which agency was impersonated.
The company said it had blocked the email address involved and alerted the relevant agency, law enforcement, and regulators. Revolut confirmed that no biometric facial telemetry data was exposed.
Crypto investigator ZachXBT indicated the incident appeared to target high-net-worth users, raising concerns about potential "wrench attacks" against known cryptocurrency holders. The breach drew criticism from social media users who questioned the security value of know-your-customer requirements.
The incident adds to a growing list of data breaches affecting companies that handle cryptocurrency users' personal information, following recent breaches at hardware wallet maker Trezor and social media platform X.
